Is CVE-2026-102461 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-102461 being exploited in the wild.

How severe is CVE-2026-102461?

Informational severity, published 15 October 2026.

Which products and versions are affected?

Eclipse Vert.X 4.0.0–4.5.34, 5.0.0–5.0.12, 5.1.0–5.1.9, 5.2.0; Eclipse Vert.x OpenAPI 4.0.0–4.5.34, 5.0.0–5.0.12, 5.1.0–5.1.8, 5.2.0; Eclipse Vert.x Web OpenAPI Router 4.0.0–4.5.34, 5.0.0–5.0.12, 5.1.0–5.1.8, 5.2.0; Eclipse Vert.x Web Validation 4.0.0–4.5.34, 5.0.0–5.0.12, 5.1.0–5.1.8, 5.2.0.

Is there a fix for CVE-2026-102461?

Yes: fixed in Vert.x 4.5.35, 5.1.9–5.1.10, 5.2.1; Vert.x Web OpenAPI Router 4.5.35, 5.1.9, 5.2.1; Vert.x Web Validation 4.5.35, 5.1.9, 5.2.1; Vert.x OpenAPI 4.5.35, 5.1.9, 5.2.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-102461 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-102461?

Check whether you run Eclipse Vert.X, Eclipse Vert.x OpenAPI, Eclipse Vert.x Web OpenAPI Router or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-102461: Eclipse Vert.x denial of service in JSON Schema uniqueItems validation

CVE-2026-102461 · Severity: info · Published 2026-10-15

Eclipse Vert.x is a framework for building reactive web applications and APIs. The JSON Schema validator in Vert.x uses an inefficient algorithm to check if array items are unique, allowing an unauthenticated attacker to send a specially crafted JSON request that exhausts server CPU resources and causes the application to become unresponsive, disrupting service availability.

Technologies: Eclipse Vert.X. Vendors: Eclipse.

Quick answers

Is CVE-2026-102461 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-102461 being exploited in the wild.
How severe is CVE-2026-102461?: Informational severity, published 15 October 2026.
Which products and versions are affected?: Eclipse Vert.X 4.0.0–4.5.34, 5.0.0–5.0.12, 5.1.0–5.1.9, 5.2.0; Eclipse Vert.x OpenAPI 4.0.0–4.5.34, 5.0.0–5.0.12, 5.1.0–5.1.8, 5.2.0; Eclipse Vert.x Web OpenAPI Router 4.0.0–4.5.34, 5.0.0–5.0.12, 5.1.0–5.1.8, 5.2.0; Eclipse Vert.x Web Validation 4.0.0–4.5.34, 5.0.0–5.0.12, 5.1.0–5.1.8, 5.2.0.
Is there a fix for CVE-2026-102461?: Yes: fixed in Vert.x 4.5.35, 5.1.9–5.1.10, 5.2.1; Vert.x Web OpenAPI Router 4.5.35, 5.1.9, 5.2.1; Vert.x Web Validation 4.5.35, 5.1.9, 5.2.1; Vert.x OpenAPI 4.5.35, 5.1.9, 5.2.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-102461 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-102461?: Check whether you run Eclipse Vert.X, Eclipse Vert.x OpenAPI, Eclipse Vert.x Web OpenAPI Router or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Vert.x 4.5.35, 5.1.9–5.1.10, 5.2.1; Vert.x Web OpenAPI Router 4.5.35, 5.1.9, 5.2.1; Vert.x Web Validation 4.5.35, 5.1.9, 5.2.1; Vert.x OpenAPI 4.5.35, 5.1.9, 5.2.1

Technical details

The uniqueItems keyword validation in vertx-json-schema uses an O(n²) pairwise comparison loop without short-circuit optimization or size limits, creating a quadratic complexity vulnerability. A remote unauthenticated attacker can submit a moderately-sized JSON array to trigger excessive CPU consumption and denial of service. The affected core library and downstream modules (vertx-web-openapi-router, vertx-web-validation, vertx-openapi) are all impacted.

Affected products

Eclipse Vert.x 4.0.0–4.5.34, 5.0.0–5.0.12, 5.1.0–5.1.9, 5.2.0
Eclipse Vert.x Web OpenAPI Router 4.0.0–4.5.34, 5.0.0–5.0.12, 5.1.0–5.1.8, 5.2.0
Eclipse Vert.x Web Validation 4.0.0–4.5.34, 5.0.0–5.0.12, 5.1.0–5.1.8, 5.2.0
Eclipse Vert.x OpenAPI 4.0.0–4.5.34, 5.0.0–5.0.12, 5.1.0–5.1.8, 5.2.0

Timeline

2026-10-07: disclosed: GitHub security advisory published
2026-10-15: advisory: CVE-2026-102461 published on NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.